Extracted

• • Target
    cc7e09f135b6cb09c0a32d54beb24789a94a5ccec038a.exe
  • Size 338KB
  • SHA256 cc7e09f135b6cb09c0a32d54beb24789a94a5ccec038a038ad2ddaeedb697ef0
  • MD5 877f963ffc32a7b22d0d57c687eba65c
  • SHA1 65508d8a5b576eb4f884e756cb817e9512a2940f
  • SHA512 ac9fe4ffa3d584687647acdb95fad970cbea4098995f3b52cdbbb4c46a58fb163c07f1db3e02dbf36bf1e834ae3e561ec83172d030bca1edfed178c2142e0aee
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoon6e76410dbdf2085ebcf2777560bd8cb0790329c9discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2